Subject

Something else that requires developers attention

Description

The latest Postfix (on Debian 13) will log the following:

postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_tls_dh1024_param_file" will be removed; instead, do not specify (leave at default)

smtpd_tls_dh1024_param_file when not configured will then defer to negotiating standard TLS 1.3 FFDHE params (presumably also works under TLS 1.2?). This will be the same behaviour when Postfix drops support entirely.

While with Dovecot the equivalent setting ssl_server_dh_file has been optional since Dovecot 2.3 so it is not required either.

• Presently in DMS we default to 4096-bit FFDHE params (standardized via RFC 7919), which is added via our Dockerfile to default Postfix + Dovecot configured file paths.
• We also have support for users to provide their own alternative custom DH params file to use instead, which our Dovecot/Postfix setup helper provides support for (assumed rarely used?).
• Related docs/tests for reference.

Since support will be dropped in future by Postfix, and ideally most connections to modern mail servers are using TLS 1.3 by now, it probably makes sense to consider dropping this default support?

We can still provide documentation for users that need this functionality, which they can add by providing their own DH params file (standard RFC 7919 files provides these with content matching the associated entries from the RFC document - these are the same DH params used by TLS 1.3 for DHE cipher-suites) and our postfix-main.cf + dovecot.cf config overrides/additions support. That will work for them until software like Postfix drops support, then they'll need to pursue further alternatives beyond what DMS can assist with.

Might be beneficial to verify if DHE ciphersuites are still negotatied for TLS 1.2 (as is expected for Postfix at least when paired with OpenSSL 3.x) on port 25 and any other port as we allow a wider range for port 25 with TLS 1.2.

Actionables:

• Remove related DH content in DMS (bulk of which should be linked above).
• Changes may require an update to our TLS tests, which may be complicated if Dovecot and Postfix diverge in behaviour for DHE support.
• Update documentation to provide guidance for manually adding back support for DHE (should only be relevant to deployments with legacy clients, TLS 1.3 has been around since 2018 and TLS 1.2 from 2008 still has other ciphers available beyond DHE). Ideally this is a simple compose.yaml snippet that would be fairly self-explanatory.
• Reference updated documentation in Changelog (with versioned docs link that will become valid upon release).